WO2021062463A1 - Procédé et système de prévention d'attaque de relais comportant une cohérence de canal - Google Patents

Procédé et système de prévention d'attaque de relais comportant une cohérence de canal Download PDF

Info

Publication number
WO2021062463A1
WO2021062463A1 PCT/AU2020/051008 AU2020051008W WO2021062463A1 WO 2021062463 A1 WO2021062463 A1 WO 2021062463A1 AU 2020051008 W AU2020051008 W AU 2020051008W WO 2021062463 A1 WO2021062463 A1 WO 2021062463A1
Authority
WO
WIPO (PCT)
Prior art keywords
signals
vehicle
time
signal
key fob
Prior art date
Application number
PCT/AU2020/051008
Other languages
English (en)
Inventor
Matthew S. KELLY
Original Assignee
Robert Bosch (Australia) Pty Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from AU2019903676A external-priority patent/AU2019903676A0/en
Application filed by Robert Bosch (Australia) Pty Ltd filed Critical Robert Bosch (Australia) Pty Ltd
Priority to DE112020004695.8T priority Critical patent/DE112020004695T5/de
Priority to US17/762,340 priority patent/US11945402B2/en
Publication of WO2021062463A1 publication Critical patent/WO2021062463A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B17/00—Monitoring; Testing
    • H04B17/20—Monitoring; Testing of receivers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/30—Services specially adapted for particular environments, situations or purposes
    • H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R25/00—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles
    • B60R25/20—Means to switch the anti-theft system on or off
    • B60R25/24—Means to switch the anti-theft system on or off using electronic identifiers containing a code not memorised by the user
    • B60R25/246—Means to switch the anti-theft system on or off using electronic identifiers containing a code not memorised by the user characterised by the challenge triggering
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R25/00—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles
    • B60R25/20—Means to switch the anti-theft system on or off
    • B60R25/2072—Means to switch the anti-theft system on or off with means for preventing jamming or interference of a remote switch control signal
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R25/00—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles
    • B60R25/20—Means to switch the anti-theft system on or off
    • B60R25/24—Means to switch the anti-theft system on or off using electronic identifiers containing a code not memorised by the user
    • B60R25/245—Means to switch the anti-theft system on or off using electronic identifiers containing a code not memorised by the user where the antenna reception area plays a role
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R25/00—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles
    • B60R25/20—Means to switch the anti-theft system on or off
    • B60R25/24—Means to switch the anti-theft system on or off using electronic identifiers containing a code not memorised by the user
    • B60R25/248—Electronic key extraction prevention
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R25/00—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles
    • B60R25/30—Detection related to theft or to other events relevant to anti-theft systems
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00309—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B17/00—Monitoring; Testing
    • H04B17/20—Monitoring; Testing of receivers
    • H04B17/27—Monitoring; Testing of receivers for locating or positioning the transmitter
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B17/00—Monitoring; Testing
    • H04B17/30—Monitoring; Testing of propagation channels
    • H04B17/309—Measuring or estimating channel quality parameters
    • H04B17/318—Received signal strength
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H04W4/023—Services making use of location information using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R2325/00—Indexing scheme relating to vehicle anti-theft devices
    • B60R2325/10—Communication protocols, communication systems of vehicle anti-theft devices
    • B60R2325/103—Near field communication [NFC]
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R2325/00—Indexing scheme relating to vehicle anti-theft devices
    • B60R2325/10—Communication protocols, communication systems of vehicle anti-theft devices
    • B60R2325/105—Radio frequency identification data [RFID]
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00309—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks
    • G07C2009/00555—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks comprising means to detect or avoid relay attacks
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C2009/00753—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated by active electrical keys
    • G07C2009/00769—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated by active electrical keys with data transmission performed by wireless means
    • G07C2009/00793—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated by active electrical keys with data transmission performed by wireless means by Hertzian waves
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B1/00—Details of transmission systems, not covered by a single one of groups H04B3/00 - H04B13/00; Details of transmission systems not characterised by the medium used for transmission
    • H04B1/38—Transceivers, i.e. devices in which transmitter and receiver form a structural unit and in which at least one part is used for functions of transmitting and receiving
    • H04B1/40—Circuits
    • H04B1/50—Circuits using different frequencies for the two directions of communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Definitions

  • the present invention relates to passive entry passive start (PEPS) systems and in particular, detection and/or prevention of relay attacks on PEPS systems in vehicles used to enter and/or start to the vehicle.
  • PEPS passive entry passive start
  • PEPS systems allow authorised users (with a valid key fob) to lock/unlock and start their vehicle without having to interact with the remote control (i.e. , authorised key fob).
  • the PEPS system may unlock or start the vehicle via a manually triggered input request (capacitive sensor, push button, etc.) if the key fob is determined to be in a valid PEPS zone.
  • a typical PEPS system defines operating regions such that if an authorised key fob is located within the correct operating region then the vehicle will respond to lock/unlock and start requests.
  • PEPS regions can be defined by low frequency (LF) signal fields emitted from antennas on the vehicle.
  • a received signal strength indicator (RSSI) is typically implemented in the authorised key fob as an abstraction of the magnetic field strength.
  • the PEPS system may define the external operating regions and internal operating regions using the RSSI signal levels from the various antennas on the vehicle. If an authorised key fob is located within the correct regions, i.e., the RSSI levels correspond to a defined zone then the vehicle will respond to lock/unlock and start requests.
  • a problem associated with PEPS systems is that vehicle thieves may utilise what is known as a “relay attack” to steal the vehicle.
  • the relay attack tricks the PEPS system into believing that the thief is an authorised user (in a defined operating region).
  • a relay attack generally requires two thieves (“Thief A” and "Thief B”) together with the authorised user (i.e., vehicle owner or other possessor of the key fob) being in the same vicinity.
  • a relay attack involves extending the range of the LF field so that an authorised key fob which is not in proximity of the vehicle will receive the LF challenge signal.
  • “Thief A” carries a relay receiver (to receive the LF signal) and is located close to the vehicle while “Thief B” carries a relay transmitter (to re transmit the LF signal) and is located in close proximity to the authorised key fob.
  • the relay receiver receives the LF signal then up-converts the frequency to a radio frequency (RF) and transmits it over an RF link to the relay transmitter.
  • the relay transmitter receives the RF signal and the down-converts the RF signal to LF and re-transmits the LF signal to an authorised key fob.
  • Analog relays are independent of the modulation and encoding of the LF signal.
  • Other relay configurations are possible, for example, a “digital relay” where the relay receiver demodulates the LF signal and then the data stream is modulated over RF and transmitted.
  • the relay transmitter demodulates the RF signal and then the data stream is modulated over LF and re-transmitted.
  • a key fob automatically transmits an RF response upon receiving the LF challenge.
  • the RF response signal will typically transmit between approximately 20 - 200m back to the vehicle. If the vehicle receives this response then it will assume that the key fob is in the vicinity of the vehicle and so the request will be authenticated.
  • the relay attack method may also be applied to extend the range of the RF response range beyond the transmit range of the key fob.
  • thieves are able to enter and start a vehicle when the key fob is outside its normal operating area by relaying messages from one location to another to make the vehicle appear closer to the key fob.
  • the present invention provides, a method of detecting if a relay is present in a PEPS system for a vehicle including the steps of: (a) transmitting from one or more antennas associated with a vehicle, a first and second LF signal and determining a minimum time gap between the two signal transmissions such that that the time gap exceeds the channel coherence time of a high frequency wireless relay; (b) determining a maximum time between the two signals allowable by a timing requirement associated with the PEPS system of the vehicle and the maximum allowable change in position of a key fob; (c) determining the time gap between the minimum time obtained at step (a) and the maximum time obtained at step (b) wherein if the time gap from step (a) is greater than the time gap from step (b), the system timing requirement is increased to provide a predetermined time; (d) separately transmitting, at the predetermined time from step (c) between the first and second LF signals, the signals having a known signal ratio, from an antenna associated with
  • the present invention takes advantage of using an extended time duration between two known LF signal levels (from the same vehicle antenna) in the LF challenge of a PEPS system in order to deliberately exceed the coherence time and thereby detect when an RF relay is used.
  • the first and second LF signals are from a single vehicle antenna.
  • step (b) is omitted and the predetermined time gap is set to the value determined at step (a).
  • a ratio of more than two LF signals are analysed.
  • the known signal values of the first and second LF signals are one or more of identical or another known ratio of each other.
  • the known signal ratio of the first and second LF signals is varied at each LF challenge.
  • determining a maximum time between the two signals allowable by a timing requirement associated with the PEPS system of the vehicle timing requirement may include for example, he maximum time must still allow the vehicle doors to unlock for a Passive Entry request within the specifications of the system.
  • the present invention provides, a system for detecting if a relay is present in a PEPS system for a vehicle including: antennas associated with a vehicle and a key fob using an LF receiver to measure LF signal levels, and one or more controllers configured to: (a) transmit from one or more antennas associated with a vehicle, a first and second LF signal and determine a minimum time gap between the two signal transmissions such that the time gap exceeds the channel coherence time of a high frequency wireless relay; (b) determine a maximum time between the two signals allowable by a timing requirement associated with the PEPS system of the vehicle and the maximum allowable change in position of a key fob; (c) determine the time gap between the minimum time obtained at step (a) and the maximum time obtained at step (b) wherein if the time gap from step (a) is greater than the time gap from step (b), the system timing requirement from step (b) is increased to provide a predetermined time; (d) separately transmit, at the predetermined
  • FIG. 1 is a schematic diagram illustrating a PEPS system
  • FIG. 2 is a schematic diagram illustrating a relay attack on a vehicle having a PEPS system
  • Figure 3 is a chart illustrating amplitude levels (dBm) of two transmitted and received signals from the same antenna associated with a vehicle;
  • Figure 4 is a chart illustrating amplitude levels (dBm) of two transmitted and received signals from the same antenna after they have been relayed over RF;
  • Figure 5 is a flow diagram illustrating the method of the present invention to prevent a relay attack on the vehicle having a PEPS system.
  • Fig. 1 is a schematic diagram illustrating a vehicle PEPS system 100.
  • the PEPS system 100 allows a vehicle owner (or possessor of the key fob) to lock/unlock and start a vehicle 105 without having to interact with the key fob 110.
  • Typical PEPS systems define external operating regions and internal operating regions. If a key fob 110 is located within an operating region then the vehicle 105 will perform PEPS lock/unlock and start requests.
  • the PEPS operating regions may be defined by low frequency (LF) signal magnetic fields emitted from antennas on the vehicle.
  • Received signal strength indicator (RSSI) can be utilised in the key fob and the PEPS system may define the external operating regions and internal operating regions using the RSSI signal levels measured from the various antennas on the vehicle 105. Then, if a key fob 110 is located within the correct regions (i.e. , the RSSI levels correspond to a defined zone) then the vehicle 105 will perform the lock/unlock and start request.
  • RSSI Received signal strength indicator
  • PEPS systems may be designed to have a manually triggered unlock and start request (such as a capacitive sensor, push button and the like provided for example on the handle of the vehicle, or in the vehicle Start/Stop 105) to transmit the LF challenge signal 115 to the key fob 110.
  • a manually triggered unlock and start request such as a capacitive sensor, push button and the like provided for example on the handle of the vehicle, or in the vehicle Start/Stop 105
  • signals are transmitted from several (or all) of the vehicles antennas. If a key fob 110 is located within the expected operating regions (based on the RSSI values measured from the vehicle antennas), after receiving the LF challenge signal 115 it will transmit an authentication response signal on a radio frequency (RF) 120 allowing the request to be processed.
  • RF radio frequency
  • Some PEPS systems also provide permanent periodically transmitted LF challenge signals 115 prior to the manually triggered unlock request.
  • the vehicle knows when the key fob 110 is in the vicinity of the vehicle before an unlock request is made. The advantage of this is that it can improve system response times and provide additional features such as comfort lighting as the owner approaches the vehicle 105.
  • the PEPS system 200 is vulnerable to theft due to what is known as "relay attack".
  • the present invention attempts to prevent a relay attack from being successful.
  • the relay attack involves extending the range of the LF field (shown in Fig. 1) so that a key fob 110 which is not in proximity of the vehicle 105 will receive the LF challenge signal.
  • the relay attack requires two thieves, Thief A and Thief B where Thief A carries a relay receiver (Relay RX) 125 and is located close to the vehicle 105 while Thief B carries a relay transmitter (Relay TX) 130 and is located close to the key fob 110.
  • Relay RX relay receiver
  • Relay TX relay transmitter
  • Relay RX 125 receives an LF signal from vehicle 105 and then up-converts the frequency to an RF frequency and transmits it via an RF link to Relay TX 130.
  • Relay TX 130 receives the RF signal and then down-converts the frequency to LF and re-transmits the LF signal to the key fob 110.
  • This scenario describes the previously defined "analog relay", however, other types of relays could be used.
  • the key fob 110 automatically transmits an RF response upon receiving the LF challenge.
  • the RF response signal will typically transmit between approximately 20 - 200m back to the vehicle 105. If the vehicle 105 receives this response it will assume that the key fob 110 is in the vicinity of the vehicle 105 and so the request will be authenticated.
  • the relay attack method may also be applied to extend the range of the RF response range beyond the transmit range of the key fob 110.
  • the present invention takes advantage of using an extended time duration between two known LF signal levels (from the same vehicle antenna) in the LF challenge of a PEPS (Passive Entry Passive Start) system in order to attempt to exceed the channel coherence time and thereby detect when an RF relay is used.
  • the signals levels are “known” in the sense that their relationship to each other is known, for example, the two signals may be the same level, or one signal may be half the level of the other signal, or any other predetermined relationship can be used.
  • the known LF signal levels may be located in the vehicle or may be provided in the key.
  • the channel coherence time for the LF messages ensures that the amplitude of the two signals is stable.
  • the LF signal is up-converted and re-transmitted at a much higher frequency and by "Thief A" 125 as shown in Figure 2 and then down-converted back to an LF signal again by "Thief B" 130.
  • the coherence time for the RF signal used in the wireless relay is much less than the coherence time at the LF frequency so the effects of a relay attack may be observed as a change in the received amplitude levels of the two LF signals (as will be described further with reference to Figures 3 and 4).
  • Equation 1 Tc is the coherence time (us)
  • c is the speed of light (m/s)
  • fc is the frequency (Hz)
  • v is the velocity (m/s) of objects in the channel:
  • Figure 3 illustrates amplitude levels (dBm) of two transmitted and received signals from the same antenna associated with a vehicle.
  • a PEPS request via a key fob for example
  • an LF message is transmitted by the vehicle.
  • two known LF signal levels are transmitted by the same LF antenna at a predetermined time.
  • the two LF signals are transmitted within the channel coherence time Tc at the PEPS LF frequency.
  • the maximum time is limited to the PEPS system timing requirement, for example, the maximum time permitted for the vehicle doors to unlock for a Passive Entry request.
  • the maximum change in position of the key fob (which implies a change in the magnetic field strength due to a change in position relative to the vehicle transmit antennas) is preferably restricted by the maximum time permitted.
  • the tolerance of the ratio is preferably dependent of the value of the signal strength used, i.e. , the proximity of the key fob to the vehicle antenna. The closer the key fob is to the antenna, the more rapidly the magnetic field varies as the key fob position changes, therefore the tolerance of the ratio calculation needs to be dependent on the magnetic field strengths measured which can be selected via empirical measurements.
  • typical antenna orientations for a vehicle 105 may be for example antenna 105a, 105b parallel to each other and located in the door handles while antenna 105c, 105d are parallel to each other and are located in the cabin and trunk of the vehicle respectively (although it will be appreciated that there may be more vehicle antennas provided).
  • the magnetic field generated by an LF antenna attenuates at a rate of l/ rf3 when the source geometry is assumed to be a point source and d is the distance from the source.
  • d is the distance from the source.
  • the measurement of the first LF signal is 1cm from a vehicle antenna 105B at point A
  • the send LF signal is measured when 2cm from the same antenna at point B, i.e., the distance of point B is twice the distance as point A from the vehicle antenna. Therefore, the magnetic field intensity at point B is 12.5% of the field intensity measured at point A.
  • the measurement of the first LF signal is 121cm from a vehicle antenna 105A at point
  • the two signals to be analysed should preferably be transmitted from an antenna that is not close to the key fob to ensure that any change in the ratio of the two signals measured is due to the channel and not a slight change in position of the key fob. For example, if the key fob is in the PEPS entry zone near antenna 105B, LF signals from this antenna should not be used to determine the signal ratio, i.e. , perform the analysis using LF signals from antennas 105A, 105C or 105D.
  • the predetermined time gap between the two LF signals is selected to a value between the minimum time gap and the maximum time gap obtained from the above methods. If the minimum time calculated is greater than the maximum time calculated, the system timing requirement from needs to be increased in order for this method to be applicable. Alternatively, instead of selecting a time gap between the minimum and maximum values, the minimum time gap can simply be selected (as long as the system timing is within specification). However, it is recommended to select a time gap as large as possible in order for the method to detect a wireless relay operating at a frequency that is lower than anticipated.
  • the channel coherence time for LF signals is very long compared to the coherence time for high frequency RF signals.
  • the coherence time for LF signals is greater than the PEPS system timing requirement (which determines the maximum time between the two LF signals)
  • the amplitude of the two LF signals in the communication channel is stable (as long as the key fob movement that occurred between the two signals is restricted as discussed above).
  • Figure 3 shows an example of the amplitude levels of two transmitted and received LF signals from the same vehicle antenna, the amplitudes of the two received signal levels are shown to be stable, i.e., their relative amplitudes are identical to the transmitted signal amplitudes.
  • the coherence time describes the time dispersive nature of the channel in a local area.
  • the two LF signals are transmitted within the channel coherence time To at the PEPS LF frequency. It describes the time varying nature of the channel caused by either relative motion between the key fob and vehicle, or by movement of objects in the channel. As discussed, the key fob should be relatively stationary during a PEPS Entry or Start command so any channel variation is due to the movement of other objects in the channel.
  • Equation 1 indicates that the channel coherence time is dependent on the velocity of objects in the channel, the faster an object is moving, the smaller the channel coherence time.
  • the predetermined time gap used between the two LF signals ensures that the channel coherence time is not exceeded in order for the ratio between the two amplitude levels to be unaffected by the channel.
  • the channel coherence time is calculated from Equation 1 as ⁇ 8s. This far exceeds the system timing for a PEPS system which ensures that the measurements of the two LF signals will be stable during the measurement time.
  • Equation 1 On the assumption that most wireless relays operate with a minimum frequency of 300MHz (this is likely a valid assumption based on relays previously investigated by the applicant) that objects in the channel are moving at speeds as low as 7km/hr ( ⁇ 2m/s) the channel coherence time is calculated from Equation 1 as ⁇ 89ms. For this example, this is the minimum time gap between the two signals to be analysed. As can be seen from Equation 1 , the success of this method in detecting a relay is dependent on the relay operational frequency and the speed that objects move within the channel.
  • the maximum time between the two signals allowed by the PEPS system timing requirement i.e. , the maximum time must still allow the vehicle doors to unlock for a Passive Entry request within specification
  • the maximum allowable change in position of the key fob which implies a change in the magnetic field strength due to a change in position relative to the vehicle transmit antennas
  • Figure 4 shows an example of the relative amplitude levels of two transmitted and received LF signals (from the same vehicle antenna) after they have been relayed over RF.
  • the two signals were not transmitted within the coherence time of the channel at this frequency and the amplitude of the two received signal levels are shown to be unstable, i.e., their relative amplitudes are different to the transmitted signal amplitudes.
  • the second LF signal is transmitted after the channel coherence time To due to the increased frequency of the wireless relay.
  • the amplitude of the two received LF signal levels must be measured by the key fob electronics.
  • the key fob contains electronic circuitry in order to receive and process LF messages and to transmit RF messages.
  • the signal levels must be compared in the key fob or in the vehicle receiver with tolerances included.
  • the concept of applying the channel coherence principle to the LF message in order to detect a relay attack is essential for this method. If the two LF signal levels do not lie within the expected range (tolerances included) then a relay attack has occurred and the PEPS process can be terminated.
  • the method 500 includes detecting if a relay is present in a PEPS system for a vehicle, where at step 505 a PEPS request is initiated, before control moves to step 510 where first and second LF signals having known signal values are transmitted, at a predetermined time separation, from an antenna associated with a vehicle to a key fob as part of an LF challenge.
  • a measurement is made by the key fob at step 515 of the signal levels of the first and second known LF signals determining a minimum time gap between the two signal transmissions such that that the time gap exceeds the channel coherence time of a high frequency wireless relay.
  • a maximum time is between the two signals allowable by a timing requirement associated with the PEPS system of the vehicle and the maximum allowable change in position of a key fob is determined and a time gap between the minimum time and the maximum time is determined.
  • Control then moves to step 520 where it is determined if the measured ratio of the first and second LF signals measured by the key fob is within a predefined range (dependent on system tolerances) of the expected ratio.
  • step 525 the PEPS process is continued (i.e. , to open a door on the vehicle or the like). Otherwise, if the measured ratio between the first and second LF signals is not within the predefined range - a relay is likely present and control moves to step 530 where the PEPS process is discontinued.
  • the present invention has the vehicle transmitting signal sequentially and for one of the antennas the present invention retransmits another signal at the same level or at another level such that the ratio between the signals is known such that if a relay is in place, the ratio is changed.
  • the present invention separates the signals as much as possible in time.
  • the present invention may even transmit signals at the same level and in that case hope to see a 1:1 ratio change.
  • the present invention thereby detects changes in the channel as opposed to, for example, detecting a limitation of the relay.
  • providing different levels is also advantageous.

Landscapes

  • Engineering & Computer Science (AREA)
  • Mechanical Engineering (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Physics & Mathematics (AREA)
  • Signal Processing (AREA)
  • Electromagnetism (AREA)
  • General Physics & Mathematics (AREA)
  • Quality & Reliability (AREA)
  • Lock And Its Accessories (AREA)

Abstract

L'invention concerne un procédé permettant de détecter si un relais est présent dans un système PEPS pour un véhicule. Le procédé consiste à transmettre un ou plusieurs signaux LF et déterminer un intervalle de temps minimal entre les deux transmissions de signaux de telle sorte que l'intervalle de temps dépasse le temps de cohérence de canal d'un relais sans fil haute fréquence. Un temps maximal admissible entre les deux signaux est déterminé par une exigence de synchronisation associée au système PEPS et au changement admissible maximal dans la position d'un porte-clés. Un intervalle de temps entre le temps minimal obtenu et le temps maximal obtenu est déterminé en fonction de l'intervalle de temps, et l'exigence de synchronisation est augmentée pour fournir un temps prédéterminé. Le temps prédéterminé transmet séparément entre les premier et second signaux LF, les signaux ayant un rapport signal connu, et on détermine si le rapport des premier et second signaux LF se situe dans une plage prédéfinie.
PCT/AU2020/051008 2019-09-30 2020-09-23 Procédé et système de prévention d'attaque de relais comportant une cohérence de canal WO2021062463A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
DE112020004695.8T DE112020004695T5 (de) 2019-09-30 2020-09-23 Verfahren und system zur verhinderung eines relaisangriffs unter einbeziehung einer kanalkohärenz
US17/762,340 US11945402B2 (en) 2019-09-30 2020-09-23 Method and system for relay attack prevention incorporating channel coherence

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
AU2019903676A AU2019903676A0 (en) 2019-09-30 Method and system for relay attack prevention incorporating channel coherence
AU2019903676 2019-09-30

Publications (1)

Publication Number Publication Date
WO2021062463A1 true WO2021062463A1 (fr) 2021-04-08

Family

ID=75336291

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/AU2020/051008 WO2021062463A1 (fr) 2019-09-30 2020-09-23 Procédé et système de prévention d'attaque de relais comportant une cohérence de canal

Country Status (3)

Country Link
US (1) US11945402B2 (fr)
DE (1) DE112020004695T5 (fr)
WO (1) WO2021062463A1 (fr)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CA2652294C (fr) 2006-05-17 2012-07-10 American Dye Source, Inc. Nouveaux materiaux pour revetements de planches lithographiques, planches lithographiques et revetements contenant ceux-ci, procedes de preparation et utilisation
US20220355763A1 (en) * 2019-04-18 2022-11-10 c/o Toyota Motor North America, Inc. Systems and methods for countering security threats in a passive keyless entry system
JP6653986B1 (ja) * 2019-12-06 2020-02-26 マレリ株式会社 リレーアタック判定装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060114100A1 (en) * 2004-11-30 2006-06-01 Riad Ghabra Integrated passive entry and remote keyless entry system
US20150302673A1 (en) * 2013-06-24 2015-10-22 Texas Instruments Incorporated Relay attack prevention for passive entry/passive start systems
US9584542B2 (en) * 2014-02-04 2017-02-28 Texas Instruments Incorporated Relay attack countermeasure system
US20180276926A1 (en) * 2015-12-10 2018-09-27 Panasonic Intellectual Property Management Co. Ltd. On-vehicle device, mobile device, and vehicle wireless communication system

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8587403B2 (en) 2009-06-18 2013-11-19 Lear Corporation Method and system of determining and preventing relay attack for passive entry system
WO2013157709A1 (fr) * 2012-04-17 2013-10-24 주식회사 대동 Procédé pour prévenir une attaque par relais sur un système de clé intelligente
KR101362325B1 (ko) * 2012-07-19 2014-02-13 현대모비스 주식회사 트렁크 자동 열림 제어 장치 및 방법
US8930045B2 (en) * 2013-05-01 2015-01-06 Delphi Technologies, Inc. Relay attack prevention for passive entry passive start (PEPS) vehicle security systems
JP6354165B2 (ja) * 2014-01-15 2018-07-11 株式会社デンソー 制御システム
US10897477B2 (en) * 2016-07-01 2021-01-19 Texas Instruments Incorporated Relay-attack resistant communications
JPWO2018070219A1 (ja) * 2016-10-14 2019-08-08 アルプスアルパイン株式会社 受信信号強度測定装置、受信信号強度測定方法及びプログラム並びにキーレスエントリーシステム
US10532719B2 (en) * 2016-12-30 2020-01-14 Robert Bosch Gmbh Bluetooth low energy (BLE) passive vehicle access control system for defending the system against relay attacks and method thereof
DE112018005902T5 (de) * 2017-11-20 2020-07-30 Robert Bosch (Australia) Pty Ltd Verfahren und system zur verhinderung von relais-angriffen mit vektorprüfung
US10919493B2 (en) * 2018-02-08 2021-02-16 Ford Global Technologies, Llc Mobile device relay attack detection and power management for vehicles
WO2020016798A1 (fr) * 2018-07-17 2020-01-23 Levl Technologies, Inc. Prévention d'attaques par relais
US11483320B2 (en) * 2019-03-22 2022-10-25 Voxx International Corporation System and method for detecting active relay station attacks between two multimedia communication platforms
JP6653985B1 (ja) * 2019-12-06 2020-02-26 マレリ株式会社 リレーアタック判定装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060114100A1 (en) * 2004-11-30 2006-06-01 Riad Ghabra Integrated passive entry and remote keyless entry system
US20150302673A1 (en) * 2013-06-24 2015-10-22 Texas Instruments Incorporated Relay attack prevention for passive entry/passive start systems
US9584542B2 (en) * 2014-02-04 2017-02-28 Texas Instruments Incorporated Relay attack countermeasure system
US20180276926A1 (en) * 2015-12-10 2018-09-27 Panasonic Intellectual Property Management Co. Ltd. On-vehicle device, mobile device, and vehicle wireless communication system

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ANSAF IBRAHEM ALRABADY: "SECURITY OF PASSIVE ACCESS VEHICLE", DISSERTATION, 2002, Wayne State University, Detroit, Michigan, pages 1 - 148, XP055811464, Retrieved from the Internet <URL:http://webpages.eng.wayne.edu/~ad5781/MyStudents/Dissertation_Ansaf.pdf> *

Also Published As

Publication number Publication date
US20220371551A1 (en) 2022-11-24
DE112020004695T5 (de) 2022-07-28
US11945402B2 (en) 2024-04-02

Similar Documents

Publication Publication Date Title
US11351962B2 (en) Electronic key system
US11945402B2 (en) Method and system for relay attack prevention incorporating channel coherence
US11696136B2 (en) Method and system for relay attack prevention incorporating motion
KR102604328B1 (ko) 릴레이 공격에 대해 시스템을 방어하기 위한 블루투스 저 에너지（ｂｌｅ） 수동 차량 액세스 제어 시스템 및 그의 방법
JP6314072B2 (ja) 携帯機、通信装置、および通信システム
CN105966353B (zh) 车辆无线通信系统、车辆控制装置和便携式机器
AU2017389381B2 (en) Bluetooth low energy (BLE) passive vehicle access control system for defending the system against relay attacks and method thereof
US11232658B2 (en) Method and system for relay attack prevention
US20210011143A1 (en) Distance measurement system
JP2008127887A (ja) 無線通信システム、その制御方法、およびプログラム
JP2017025599A (ja) 車載機器制御システム、車載制御装置、携帯機
JP6995434B2 (ja) キーレスエントリーシステム
KR102225967B1 (ko) 릴레이 공격의 방어
US11524655B2 (en) Method and system for relay attack prevention incorporating vector check
US9902369B2 (en) Apparatus and method for dual range detection in a vehicle
KR20190064520A (ko) 차량 억세스 제어 방법 및 차량 억세스 제어 시스템
WO2001025060A2 (fr) Systeme de detection d&#39;agression a relai avec communications protegees de commande de vehicule
JP2010516925A (ja) 誘導結合されたアクセスシステムにおける距離の特徴付けのための方法
US20220024412A1 (en) Method and System for Relay Attack Prevention Using Subzones
CN114793458A (zh) 中继站攻击预防
US11427160B2 (en) Field superposition method and system
CN110402457A (zh) 用于安全访问机动车辆的方法
WO2021124766A1 (fr) Système de clé électronique
KR101962914B1 (ko) 스마트키를 이용한 차량 도어 개폐 방법 및 장치
EP3671668B1 (fr) Clé électronique et procédé de fonctionnement associé

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20872097

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 20872097

Country of ref document: EP

Kind code of ref document: A1